Blahalla

Charter Communications Data Breach Could Impact Nearly 5 Million

www.securityweek.com · a month ago

The notorious ShinyHunters extortion group leaked over 42 million records allegedly stolen from Charter in April.

Attackers Use LLM Agent for Post-Exploitation After Marimo CVE-2026-39987 Exploit

thehackernews.com · a month ago

An unknown threat actor has been observed using a large language model (LLM) agent to conduct post-compromise actions after obtaining initial access following the exploitation of a publicly-accessible Marimo network using a recently disclosed vulnerability. "The attacker compromised an internet-reachable Marimo notebook via CVE-2026-39987, extracted two cloud credentials from the compromised

Asia's Cyber Insurance Market Shows Signs of Life

www.darkreading.com · a month ago

The cyber insurance industry has made relatively weak inroads into Asia due to a a variety of factors, but that could be changing.

MokN Raises $15 Million for Phish-Back Platform

www.securityweek.com · a month ago

MokN's platform deploys realistic decoy access points to lure attackers into revealing compromised credentials, enabling organizations to respond before abuse occurs.

From $5 Attacks to Botnet-Powered Platforms: Inside the DDoS-as-a- Service Market

www.bleepingcomputer.com · a month ago

DDoS attacks are increasingly being sold like subscription services, complete with pricing tiers, support, and reseller programs. Flare explores how the DDoS-as-a-Service market has evolved from scattered tools into polished attack platforms.

Dutch govt disrupts malware botnet with 17 million infected devices

www.bleepingcomputer.com · a month ago

Dutch authorities have taken offline a massive botnet of 17 million devices and seized more than 200 servers at a local provider that supported the operation.

Ransomware Abuses SYSTEM Task to Encrypt Drives with Elevated Privileges

gbhackers.com · a month ago

A newly analyzed ransomware strain, “The Gentlemen,” is raising concern among security researchers due to its ability to combine strong encryption with aggressive lateral movement. What makes this threat particularly dangerous is its use of SYSTEM-level scheduled tasks to encrypt local drives, allowing attackers to operate with the highest Windows systems privileges. This technique ensures

With Complex Cloud Integrations, Small Errors Lead to Major Compromises

www.darkreading.com · a month ago

Researchers discover an exploit chain combining over-permissioned roles, secrets discovery, and non-human identities that could have compromised a popular automation service.

Gogs Zero-Day Exposes Servers to Remote Code Execution

www.securityweek.com · a month ago

The critical-severity issue, assigned a CVSS score of 9.4, is an argument injection flaw that can be exploited by authenticated attackers via pull requests with malicious branch names.

JINX-0164 Uses LinkedIn Lures to Deploy Custom macOS Malware

gbhackers.com · a month ago

A newly identified threat actor tracked as JINX-0164 is targeting cryptocurrency organizations through sophisticated LinkedIn-based social engineering campaigns. The financially motivated group has been active since at least mid-2025. It is leveraging custom macOS malware, credential theft, and CI/CD pipeline abuse to infiltrate development environments and steal sensitive assets. These profiles appeared highly credible, often

Google Chrome adds session cookie theft protection for all users

www.bleepingcomputer.com · a month ago

Google says the Chrome Device Bound Session Credentials (DBSC) security feature is now generally available and is rolling out to all users to prevent account takeovers.

'The Com' Cyberattacks Support Violence & Sexploitation

www.darkreading.com · a month ago

Your organization's security failures have consequences for everyone else too, since this neo-Nazi-infested criminal gang uses its cyber winnings to support more violent and widespread crimes.

GREYVIBE Threat Actors Use ChatGPT and Google Gemini to Scale Cyberattack Operations

gbhackers.com · a month ago

Threat actors are increasingly turning to generative AI tools such as ChatGPT and Google Gemini to accelerate cyberattack operations, lowering technical barriers and reshaping modern threat landscapes. A recent report by WithSecure highlights a Russia-linked threat group, tracked as GREYVIBE, that has systematically integrated large language models (LLMs) into its campaigns targeting Ukraine and related

New Russia-Linked GREYVIBE Targets Ukraine with AI-Powered Cyberattacks

thehackernews.com · a month ago

A previously undocumented threat actor dubbed GREYVIBE has been attributed to ongoing and persistent attacks targeting Ukraine and Ukraine-related entities since at least August 2025. GREYVIBE, per WithSecure, is assessed to be a Russian-speaking group operating broadly in the Russian time zone, with the activities aligning with Kremlin state interests, specifically when it comes to

Malicious NuGet Package Disguised as Sicoob SDK Exfiltrates Banking Passwords

gbhackers.com · a month ago

A newly discovered malicious NuGet package disguised as a legitimate Sicoob software development kit (SDK) has been caught exfiltrating sensitive banking credentials, highlighting a dangerous evolution in software supply chain attacks. Security researchers from Socket revealed that the package, published under the name “Sicoob.Sdk,” impersonates official developer tooling used for integrating with Brazil’s Sicoob banking

California Sues 23andMe, Alleging It Failed to Protect User Data in 2023 Breach

www.securityweek.com · a month ago

Attorney General Rob Bonta filed the lawsuit against Chrome Holding Co., which 23andMe rebranded under after filing for bankruptcy last March.

Man sent to prison for selling data of 7 millions elderly Americans

www.bleepingcomputer.com · a month ago

A North Carolina man was sentenced to more than 10 years in prison for selling the personal information of over 7 million elderly Americans to Jamaican scammers.

Interesting Times: Why Are We Still Driving?

www.nytimes.com · a month ago

Confronting the weirdness of a Waymo future.

Trusted Dev Tools Abused to Steal Code and Secrets

gbhackers.com · a month ago

Attackers are increasingly weaponizing trusted developer tools to infiltrate software supply chains, with CISA warning of multiple ongoing campaigns targeting CI/CD ecosystems and developer workflows. Recent incidents, including a compromised Visual Studio Code extension and a large-scale operation dubbed “Megalodon,” highlight how adversaries are exploiting the very tools designed to accelerate modern software development. One

What 2,000 Exposed Vibe-Coded Apps Reveal About the Limits of Most Security Stacks

thehackernews.com · a month ago

Shadow AI used to mean employees pasting things they shouldn't into ChatGPT. It now means something bigger: employees building full applications with AI, wiring them into production systems, and publishing them on the open internet. Without Security or IT in the loop. The artifact moved from a prompt to a product. The risk surface moved with it. In The Shadow Builders report (get it here), a

Chrome 148 Update Patches 151 Vulnerabilities

www.securityweek.com · a month ago

The browser update resolves critical-severity security defects that could potentially lead to remote code execution.

US charges Google security engineer with Polymarket insider trading

www.bleepingcomputer.com · a month ago

A Google security engineer was charged with insider trading after winning $1.2 million using confidential company data to place bets on the cryptocurrency-based Polymarket decentralized prediction market.

Typosquatted npm Packages Steal Cloud and CI/CD Secrets

gbhackers.com · a month ago

A coordinated npm supply chain attack has been uncovered targeting developers working with OpenSearch, ElasticSearch, and DevOps tooling, with attackers actively stealing cloud credentials and CI/CD secrets from infected systems. The malicious packages imitate legitimate libraries by using lookalike names such as opensearch-setup and elastic-opensearch-helper, while falsely linking to the official OpenSearch GitHub repository in

GitLab Patches Multiple Duo AI, DoS, and Authorisation Vulnerabilities

gbhackers.com · a month ago

GitLab has released patch versions 19.0.1, 18.11.4, and 18.10.7 to fix seven security issues affecting GitLab CE and EE, including Duo AI workflow runner access control, a Wiki denial-of-service flaw, and several authorization bugs across GraphQL, Duo Workflows, Operations, Pipelines, and authentication endpoints. The company says self-managed installations should upgrade immediately. At the same time

Notepad++ vulnerabilities could enable arbitrary code execution on Windows systems

www.csoonline.com · a month ago

Two high severity vulnerabilities, CVE-2026-48778 and CVE-2026-48800, allow local attackers to achieve arbitrary code execution in Notepad++ by modifying XML configuration files. The flaws exist because the editor reads command and interpreter paths without validation, enabling malicious commands to be injected into the Run menu or substituted for the operating system command prompt. An attacker with write access to the user’s profile can exploit these weaknesses, while a third, lower severity crash bug is tracked as CVE-2026-48770. Users are advised that these vulnerabilities were patched in version 8.9.6.1.

Malicious Sicoob NuGet Steals Banking Credentials as npm Packages Target Cloud Secrets

thehackernews.com · a month ago

Cybersecurity researchers have discovered a malicious NuGet package that masquerades as a C software development kit for Sicoob, one of Brazil's largest cooperative financial systems, to siphon client IDs and PFX certificates. According to Socket, versions 2.0.0 through 2.0.4 of "Sicoob.Sdk" contain functionality to exfiltrate sensitive information, including PFX certificates that are used to

The Gentlemen are coming for your files, and then your network

www.csoonline.com · a month ago

Gentlemen ransomware uses a self-propagating Go based encryptor that can move laterally across networks. This malware identifies additional systems and spreads over Server Message Block using harvested credentials. Operators can control the encryptor through command line arguments for tasks like full drive encryption or lateral propagation. Experts advise defenders to focus on understanding the attack path and network controls to contain the threat.

Amid data center protests, a billionaire and the Trump administration see a foreign plot

www.washingtonpost.com · a month ago

Claims by a billionaire TV star and Interior Secretary Doug Burgum that China and overseas propaganda drive American protests against data centers are based on scant evidence.

Cybersecurity trends in SEC filings

www.csoonline.com · a month ago

Public companies are required by the SEC to disclose comprehensive information regarding cybersecurity risk management, governance, and strategy in their 10-K filings. The Chief Information Security Officer remains the primary role responsible for cybersecurity, and board oversight most frequently falls under the Audit Committee. Data suggests that the CISO position typically reports to the Chief Information Officer. These disclosures reveal a reliance on frameworks like the National Institute of Standards and Technology guidelines to manage growing risks.

Fake Adobe Document Cloud Pages Spread ScreenConnect Malware

gbhackers.com · a month ago

Hackers are actively exploiting trust in Adobe Document Cloud by using fake delivery pages to install remote access malware. The campaign leverages a sophisticated phishing kit named “RatPressto,” which abuses compromised WordPress sites and legitimate software to evade detection while targeting financial organizations. The attack begins with phishing emails that appear to be standard corporate

1,001 IPs, 64 countries, one operation: mapping a botnet by its back end · HoneyLabs blog

honeylabs.net · a month ago

A large botnet operation involving one thousand one IP addresses spread across sixty four countries was mapped using backend infrastructure and unique client fingerprints. Investigators determined that the shared back end and consistent TLS and HTTP fingerprints provided a unified view of the campaign, even when individual IPs rotated. The operation utilized an exploit based on Apache path traversal, identified as CVE-2021-41773. This vulnerability deployed a self-replicating shell stage that turned every infected server into a new node for the attack.

Charter Communications data breach affects 4.9 million accounts

www.bleepingcomputer.com · a month ago

The ShinyHunters extortion gang stole personal information from 4.9 million accounts after hacking the U.S. telecom giant Charter Communications in early April, according to data breach notification service Have I Been Pwned.

Police arrest man following hack of Ajax football club

www.bitdefender.com · a month ago

Dutch police have arrested a 35-year-old man suspected of hacking into the computer systems of Amsterdam football giant Ajax, after the personal data of hundreds of thousands of supporters was put at risk. Read more in my article on the Hot for Security blog.

Samba Security Flaw Lets Attackers Execute Code Remotely

gbhackers.com · a month ago

A critical security vulnerability in Samba’s printing subsystem has been disclosed, allowing unauthenticated attackers to execute arbitrary code remotely on affected servers. Tracked as CVE-2026-4480, the flaw carries a maximum CVSS score of 10.0, highlighting its severe impact on confidentiality, integrity, and availability. The issue affects Samba print servers configured with the “print command” and

Zapocalypse Attack Lets Threat Actors Hijack Zapier Accounts

gbhackers.com · a month ago

“Zapocalypse” is a newly disclosed attack chain that shows how attackers could have abused Zapier’s “Code by Zapier” feature to move from a single sandboxed Python step to a potential full-scale Zapier account takeover. The research, carried out by Token Security, is notable because it did not rely on any unknown zero‑days or exotic primitives.

I evaluated 5 LLM agents on patching real-world CVEs. Here is what I found.

giovannigatti.github.io · a month ago

The evaluation used a new benchmark called CVE-Bench, designed to test how well AI models can fix real-world security vulnerabilities. Five frontier models were tested on 20 actual CVEs, reaching a maximum overall solve rate of 50 percent under favorable conditions. Researchers found that no model reliably fixes real vulnerabilities, and the difficulty increased significantly when models had to fix code without a description of the flaw. The benchmark covered a broad range of weaknesses across 15 categories of CWE issues.

OpenVPN Connect macOS Vulnerability Allows Remote Command Execution

gbhackers.com · a month ago

OpenVPN has released a critical security update for its macOS client after researchers uncovered a vulnerability that could allow remote command execution on affected systems. The issue, tracked as CVE-2026-9560, impacts the privileged helper component in OpenVPN Connect and has been fixed in version 3.8.2 (build 6009), released on May 25, 2026. OpenVPN Connect macOS

Claude Opus 4.8 Released With Advanced Engineering-Level Coding Capabilities

gbhackers.com · a month ago

Anthropic has announced the release of Claude Opus 4.8, a major upgrade to its flagship AI model that introduces advanced engineering-level coding capabilities and improved autonomous task execution. The latest version builds on Opus 4.7, focusing on enhanced reasoning, longer independent operation, and more transparent decision-making. These improvements are expected to affect both software development

GDPR set the tone for regulatory action — and the AI fine pushback to come

www.csoonline.com · a month ago

While large technology companies continue to challenge fines related to European data protection law, nearly 40 percent of announced General Data Protection Regulation fines are currently under legal challenge or have been annulled. The regulation successfully established a global standard, notably the influential 72-hour breach notification rule. Experts contend that even with structural weaknesses in enforcement, the law has significantly improved corporate security maturity. Furthermore, the framework is evolving due to the approaching full application of the European Union's comprehensive AI Act.

Fake Video Player Updates Spread Miner and RAT Malware

gbhackers.com · a month ago

Hackers are actively exploiting illegal streaming platforms to distribute advanced malware, using fake video player updates as a lure to infect unsuspecting users. The attack begins when users attempt to play a video on compromised streaming websites. Instead of playback, a message appears claiming the video player plugin is outdated, prompting users to download an

Fake Codex Remote UI Steals OpenAI Auth Tokens

gbhackers.com · a month ago

A newly uncovered supply chain attack is leveraging a legitimate-looking developer tool, codexui-android, to silently steal OpenAI Codex authentication tokens, highlighting a growing trend where threat actors build credible software to mask malicious intent. Unlike typical typosquatting or disposable malware packages, this tool delivers real functionality, making it attractive to developers. However, investigators found that for

Kimsuky Deploys HTTPSpy, Expands Arsenal with HelloDoor and VS Code Tunnels

thehackernews.com · a month ago

The North Korean state-sponsored threat actor known as Kimsuky (aka Velvet Chollima) has been attributed to a fresh set of cyber attacks targeting South Korean military and corporate entities through March and April 2026. "Kimsuky employed a range of tailored social engineering tactics, such as spoofing security software installation pages and crafting a fake Webex meeting page that leveraged

MicrosoftSystem64 Malware Abuses Hugging Face for Stealthy Data Theft

gbhackers.com · a month ago

A sophisticated supply chain attack targeting the npm ecosystem has been uncovered, involving a malicious package named js-logger-pack that evolved into a powerful cross-platform malware loader. First observed in early April 2026, the package went through 29 incremental versions, gradually transforming from a seemingly benign logging utility into a full-scale information stealer and remote access Trojan. Despite

Carnival Cruise Breach Leaks Sensitive Customer Information

gbhackers.com · a month ago

Carnival Corporation has disclosed a significant data breach impacting approximately 5.99 million individuals, raising serious concerns about data security within the global travel and hospitality sector. The incident, officially reported to the Maine Attorney General’s office, involved unauthorized access to sensitive customer information for 9,746 Maine residents. Carnival Cruise Breach According to regulatory filings, the

Malicious RVTools Installer Uses Sectigo Cert to Evade SmartScreen

gbhackers.com · a month ago

A malicious fake RVTools installer is abusing a legitimately issued Sectigo code‑signing certificate to slip past Microsoft Defender SmartScreen and many endpoint controls, ultimately deploying a multi‑stage Python‑based RAT with deep AD reconnaissance and persistent C2 access. For VMware‑heavy environments, compromise of an administrator via this vector can effectively hand over domain‑level control to the

New Gogs 0-Day Flaw Enables Remote Code Execution on Servers

gbhackers.com · a month ago

A new 0-day vulnerability in Gogs, a popular self-hosted Git service, allows authenticated users to run arbitrary commands on the server and potentially take full control of the system. The flaw was discovered by Rapid7 Labs and is rated Critical with a CVSS v4 score of 9.4. At the time of publication, there is no

Fooling around with encrypted reasoning blobs

blog.cryptographyengineering.com · a month ago

Advanced methods for handling encrypted reasoning data were detailed. These encrypted reasoning blobs hold complex information that requires strong cryptographic protections. Techniques were discussed that preserve the utility of the data while strictly maintaining confidentiality. Understanding these novel approaches is critical for deploying secure and trustworthy artificial intelligence systems.

CALIF: An AI audit of FreeBSD

blog.calif.io · a month ago

An artificial intelligence audit was performed on the FreeBSD operating system to assess its security posture. The analysis identified areas for improvement across various system components. Researchers highlighted the benefits of adopting a comprehensive, automated approach to continuous security testing. Implementing these recommendations can significantly enhance the overall resilience and reliability of the platform.

Typosquatted npm packages used to steal cloud and CI/CD secrets

www.microsoft.com · a month ago

The Mini Shai-Hulud campaign used malicious npm packages to target cloud and CI/CD credentials across developer environments. This report details the attack chain, detection opportunities, and mitigation guidance to help organizations identify and disrupt related activity.

IBM and Red Hat want to become the ‘security clearinghouse’ for open source applications in the enterprise

www.csoonline.com · a month ago

IBM and Red Hat are launching Project Lightwell, a $5 billion initiative involving 20,000 engineers to establish an enterprise clearinghouse for open source vulnerabilities. This new system will use artificial intelligence to accelerate the discovery and delivery of validated fixes directly into software supply chains. The technology functions as a security coordination layer, allowing patches to be backported to exact dependency versions without requiring disruptive upgrades. The project addresses the vulnerability gap, acknowledging the publication of nearly 50,000 common vulnerabilities and exposures in 2025.